Executive brief
PrestaShop's psgdpr module is a GDPR compliance extension for e-commerce sites that tracks customer consent to data processing. Authenticated attackers can forge consent records for arbitrary other customers by manipulating request parameters, corrupting audit logs and potentially masking non-compliance or framing customers for unwanted consent grants.
Technical details
The vulnerability is an insufficient authorization check in the FrontAjaxGdpr controller. While the code validates a customer_token or guest_token to ensure the request is authentic, it does not verify that the id_customer parameter matches the authenticated user before logging consent. An attacker can submit an arbitrary customer ID in the request payload, and if the token validation passes for their own session, the GDPRLog::addLog() call will create a forged consent entry attributed to any customer ID they specify. The attack requires authentication but allows an attacker to corrupt the consent audit trail for other users.
Affected products
- PrestaShop psgdpr through 1.4.3
Timeline
- 2026-09-16: disclosed